7344 matches found
CVE-2018-18703
PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal, bypassing the login page, as demonstrated by the Mailserverfilesystem/home.php...
CVE-2016-10732
ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...
Sql injection
ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...
CVE-2016-10731
ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...
AlienIP 2.41 - Denial of Service (PoC)
AlienIP 2.41 - Denial of Service PoC Exploit Title: AlienIP 2.41 - Denial of Service PoC Author: Arturo de la Cruz Tellez Discovery Date: 2018-10-17 Vendor Homepage: http://www.armcode.com Tested Version: 2.41 Tested on OS: Microsoft Windows 10 Home Single Language x64 Versión 10.0.10240...
CVE-2016-10731
CVE-2016-10731 affects ProjectSend (formerly cFTP) r582 and enables SQL injection via multiple PHP endpoints: manage-files.php (status, files), clients.php (selected_clients, status), process-zip-download.php (file), or home-log.php (action). Root cause: input parameters are used in SQL queries w...
Security update for pam_pkcs11 (moderate)
This update for pampkcs11 fixes the following security issues: - It was possible to replay an authentication by using a specially prepared smartcard or token bsc1105012 - Prevent buffer overflow if a user has a home directory with a length of more than 512 bytes bsc1105012 - Memory not cleaned...
Are the Police Using Smart-Home IoT Devices to Spy on People?
IoT devices are surveillance devices, and manufacturers generally use them to collect data on their customers. Surveillance is still the business model of the Internet, and this data is used against the customers' interests: either by the device manufacturer or by some third party the manufacture...
PT-2018-2497 · Medion +3 · Medion Lifecloud Nas +3
Name of the Vulnerable Software and Affected Versions: Seagate GoFlex Home affected versions not specified Medion LifeCloud NAS affected versions not specified Netgear Stora affected versions not specified Description: The issue is related to an incorrect restriction of XML links to external...
WPScan v3.3.1 - Black Box WordPress Vulnerability Scanner
WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites. INSTALL Prerequisites: Ruby = 2.2.2 - Recommended: 2.3.3 Curl = 7.21 - Recommended: latest - FYI the 7.29 has a segfault...
Oracle Database Server 'Rapid Home Provisioning' Component Unspecified Vulnerability
Oracle Database Server is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
nc-cms cross-site scripting vulnerability
nc-cms is a PHP-based embeddable lightweight CMS content management system. A cross-site scripting vulnerability exists in the index.php?action=edithtml&name=homecontent URI in nc-cms 2017-03-10 and earlier versions, which can be exploited by remote attackers to inject malicious JavaScript code...
CVE-2018-18290
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml&name=homecontent allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality...
Which? Magazine recommends vulnerable smart home camera
You’ll already know that we have a keen interest in smart home camera security. Our recent work on Swann and FLIR cameras showed how it could be trivially easy to spy on people through their security cameras. Which? Magazine has a well-earned reputation for providing product reviews for consumers...
Wi-Fi Gets Simplified Version Numbers and Next Version is Wi-Fi 6
Do you know what is the latest version of Wi-Fi? It's okay if you don't know. It is — Wi-Fi is 802.11ac. I am sure many of us can't answer this question immediately because the Wi-Fi technology doesn't have a traditional format of version numbers… at least until yesterday. The Wi-Fi Alliance—the...
Meet GhostDNS: The dangerous malware behind IoT botnet targeting banks
By Waqas Security researchers at NetLab, a sub-division of the Chinese cybersecurity firm Qihoo 360, have discovered a new, wide-scale, and very active malware campaign that has managed to hijack more than 100,000 home routers between Sept 21 and 27. A majority of routers almost 88% are located i...
National Cybersecurity Awareness Month: Cybersecurity at Home
October is National Cybersecurity Awareness Month NCSAM, an annual campaign to raise awareness about cybersecurity. The National Cyber Security Alliance NCSA has published general tips to help you increase your cybersecurity awareness—including whom to contact if you are the victim of cyber...
Malwarebytes is a champion of National Cybersecurity Awareness Month
October is here. For most of us in the US cybersecurity industry, it’s the month when we commemorate National Cybersecurity Awareness Month NCSAM. For those who are unfamiliar with this campaign, NCSAM generally aims at driving awareness for safe Internet use, whether you're a regular consumer or...
